refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦
- 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块
- 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支
- 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合
- 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor
- 前端适配：调整 admin API 调用和 provider 模型测试对话框

apps/aether-gateway/src/data/tests.rs

@@ -4,28 +4,31 @@ use aether_crypto::{encrypt_python_fernet_plaintext, DEVELOPMENT_ENCRYPTION_KEY}
 use aether_data::repository::auth::{
     InMemoryAuthApiKeySnapshotRepository, StoredAuthApiKeySnapshot,
 };
-use aether_data::repository::candidate_selection::{
-    InMemoryMinimalCandidateSelectionReadRepository, StoredMinimalCandidateSelectionRow,
-    StoredProviderModelMapping,
-};
-use aether_data::repository::candidates::{
-    InMemoryRequestCandidateRepository, RequestCandidateStatus, StoredRequestCandidate,
-};
-use aether_data::repository::provider_catalog::{
-    InMemoryProviderCatalogReadRepository, StoredProviderCatalogEndpoint, StoredProviderCatalogKey,
-    StoredProviderCatalogProvider,
-};
+use aether_data::repository::candidate_selection::InMemoryMinimalCandidateSelectionReadRepository;
+use aether_data::repository::candidates::InMemoryRequestCandidateRepository;
+use aether_data::repository::provider_catalog::InMemoryProviderCatalogReadRepository;
 use aether_data::repository::shadow_results::{
     InMemoryShadowResultRepository, RecordShadowResultSample, ShadowResultLookupKey,
     ShadowResultMatchStatus, ShadowResultReadRepository, ShadowResultSampleOrigin,
     ShadowResultWriteRepository, StoredShadowResult, UpsertShadowResult,
 };
-use aether_data::repository::usage::{InMemoryUsageReadRepository, StoredRequestUsageAudit};
-use aether_data::repository::video_tasks::{
-    InMemoryVideoTaskRepository, UpsertVideoTask, VideoTaskLookupKey, VideoTaskStatus,
-    VideoTaskWriteRepository,
-};
+use aether_data::repository::usage::InMemoryUsageReadRepository;
+use aether_data::repository::video_tasks::InMemoryVideoTaskRepository;
 use aether_data::DataLayerError;
+use aether_data_contracts::repository::candidate_selection::{
+    StoredMinimalCandidateSelectionRow, StoredProviderModelMapping,
+};
+use aether_data_contracts::repository::candidates::{
+    RequestCandidateStatus, StoredRequestCandidate,
+};
+use aether_data_contracts::repository::provider_catalog::{
+    StoredProviderCatalogEndpoint, StoredProviderCatalogKey, StoredProviderCatalogProvider,
+};
+use aether_data_contracts::repository::usage::StoredRequestUsageAudit;
+use aether_data_contracts::repository::video_tasks::{
+    UpsertVideoTask, VideoTaskLookupKey, VideoTaskStatus, VideoTaskWriteRepository,
+};
+use aether_scheduler_core::{build_minimal_candidate_selection, SchedulerAuthConstraints};
 use async_trait::async_trait;
 use serde_json::json;
 
@@ -643,14 +646,31 @@ async fn data_state_reads_minimal_candidate_selection_with_auth_filters() {
         .expect("auth snapshot should read")
         .expect("auth snapshot should exist");
 
-    let selection = crate::scheduler::read_minimal_candidate_selection(
-        &state,
+    let rows = state
+        .list_minimal_candidate_selection_rows("openai:chat", "gpt-4.1")
+        .await
+        .expect("minimal candidate selection rows should read");
+    let auth_constraints = SchedulerAuthConstraints {
+        allowed_providers: auth_snapshot
+            .effective_allowed_providers()
+            .map(|items| items.to_vec()),
+        allowed_api_formats: auth_snapshot
+            .effective_allowed_api_formats()
+            .map(|items| items.to_vec()),
+        allowed_models: auth_snapshot
+            .effective_allowed_models()
+            .map(|items| items.to_vec()),
+    };
+
+    let selection = build_minimal_candidate_selection(
+        rows,
         "openai:chat",
         "gpt-4.1",
+        "gpt-4.1",
         false,
-        Some(&auth_snapshot),
+        Some(&auth_constraints),
+        Some(auth_snapshot.api_key_id.as_str()),
     )
-    .await
     .expect("selection should read");
 
     assert_eq!(selection.len(), 2);